97 lines
2.8 KiB
PHP
97 lines
2.8 KiB
PHP
|
<?php
|
||
|
|
namespace AuroraAdmin\Options;
|
||
|
|
|
||
|
|
defined("ABSPATH") || exit();
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Single source of truth for the aurora_admin_settings option.
|
||
|
|
* Deliberately simple — no request-lifetime caching layer, no schema
|
||
|
|
* ceremony beyond what register_setting requires. Add fields as pages
|
||
|
|
* actually need them.
|
||
|
|
*/
|
||
|
|
class Settings
|
||
|
|
{
|
||
|
|
const OPTION_NAME = "aurora_admin_settings";
|
||
|
|
|
||
|
|
public function __construct()
|
||
|
|
{
|
||
|
|
add_action("init", [self::class, "register"]);
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function register()
|
||
|
|
{
|
||
|
|
register_setting("aurora-admin", self::OPTION_NAME, [
|
||
|
|
"type" => "object",
|
||
|
|
"default" => [],
|
||
|
|
"capability" => "manage_options",
|
||
|
|
// Merge incoming payloads into the stored value instead of replacing
|
||
|
|
// it wholesale. This lets pages save just the keys they own (e.g. the
|
||
|
|
// dashboard sends only dashboard_card_order, the shell only dark_mode)
|
||
|
|
// without wiping settings they never received — which matters because
|
||
|
|
// most pages get a sanitized copy with secrets stripped (see
|
||
|
|
// get_safe()) and must never write that stripped copy back.
|
||
|
|
"sanitize_callback" => [self::class, "merge_on_save"],
|
||
|
|
"show_in_rest" => [
|
||
|
|
"schema" => [
|
||
|
|
"type" => "object",
|
||
|
|
"properties" => [
|
||
|
|
"dark_mode" => ["type" => "string"],
|
||
|
|
"dashboard_card_order" => ["type" => "object"],
|
||
|
|
],
|
||
|
|
"additionalProperties" => true,
|
||
|
|
],
|
||
|
|
],
|
||
|
|
]);
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function merge_on_save($value)
|
||
|
|
{
|
||
|
|
$existing = get_option(self::OPTION_NAME, []);
|
||
|
|
if (!is_array($existing)) {
|
||
|
|
$existing = [];
|
||
|
|
}
|
||
|
|
if (!is_array($value)) {
|
||
|
|
return $existing;
|
||
|
|
}
|
||
|
|
return array_merge($existing, $value);
|
||
|
|
}
|
||
|
|
|
||
|
|
public static function get($key = null, $default = null)
|
||
|
|
{
|
||
|
|
$settings = get_option(self::OPTION_NAME, []);
|
||
|
|
if (!is_array($settings)) {
|
||
|
|
$settings = [];
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($key === null) {
|
||
|
|
return $settings;
|
||
|
|
}
|
||
|
|
|
||
|
|
return isset($settings[$key]) ? $settings[$key] : $default;
|
||
|
|
}
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Settings safe to expose on every admin page (the shell serializes this
|
||
|
|
* for all logged-in users). Strips secrets: the license key and remote
|
||
|
|
* site application passwords. The settings page itself (manage_options
|
||
|
|
* only) uses get() and receives the full value.
|
||
|
|
*/
|
||
|
|
public static function get_safe()
|
||
|
|
{
|
||
|
|
$settings = self::get();
|
||
|
|
|
||
|
|
unset($settings["license_key"]);
|
||
|
|
|
||
|
|
if (isset($settings["remote_sites"]) && is_array($settings["remote_sites"])) {
|
||
|
|
$settings["remote_sites"] = array_values(array_map(function ($site) {
|
||
|
|
return [
|
||
|
|
"url" => isset($site["url"]) ? $site["url"] : "",
|
||
|
|
"username" => isset($site["username"]) ? $site["username"] : "",
|
||
|
|
];
|
||
|
|
}, $settings["remote_sites"]));
|
||
|
|
}
|
||
|
|
|
||
|
|
return $settings;
|
||
|
|
}
|
||
|
|
}
|